Openclaw cli: OpenClaw voice-call media stream validated streams after upgrade, which could allow pre-start unauthenticated sockets to increase resource pressure (CVE-2026-32062)
Description
OpenClaw voice-call media-stream WebSocket connections accepted upgrades before validating streams, allowing unauthenticated pre-start sockets to remain open and increase resource usage. This vulnerability affects openclaw versions up to 2026.2.21-2 and @openclaw/voice-call versions up to 2026.2.21. The issue is patched in version 2026.2.22. The vulnerability can lead to resource exhaustion and degraded service availability under sustained abuse.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The OpenClaw voice-call media-stream component accepted WebSocket upgrades before validating the stream via the shouldAcceptStream() check, which only occurred after receiving a start frame. This created a window where unauthenticated pre-start sockets could be held open, increasing resource pressure on the server. The vulnerability affects openclaw (npm) versions <= 2026.2.21-2 and @openclaw/voice-call (npm) versions <= 2026.2.21. The fix, released in version 2026.2.22, introduces strict pre-start timeouts, global and per-IP pending connection caps, total open connection caps, and safer upgrade-path parsing to mitigate resource exhaustion risks.
Potential Impact
This vulnerability poses an availability risk in deployments where the media-stream endpoint is reachable and streaming is enabled. Attackers can hold unauthenticated sockets open before stream validation, consuming connection-related resources and potentially degrading service quality or causing denial of service for legitimate users.
Mitigation Recommendations
A fix is available in openclaw and @openclaw/voice-call version 2026.2.22. The patch adds strict pre-start timeouts to close sockets that do not send a valid start frame promptly, global and per-IP pending connection caps, total open media-stream connection caps, and improved upgrade-path parsing. Users should upgrade to version 2026.2.22 or later to remediate this vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-32062
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6ac245b812601ec6a3166bce
Added to database: 10/04/2026, 12:25:28 UTC
Last enriched: 10/04/2026, 13:01:47 UTC
Last updated: 10/04/2026, 16:08:37 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.